{"data":{"skill":{"slug":"xiewxx-maxhub-wechat","name":"maxhub-wechat","icon":"📦","repo":"https://github.com/XieWxx/maxhub-api-skills/tree/main/maxhub-wechat","status":"approved","author":"XieWxx","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"ab6bdc94-5f07-474b-bfa8-5930bf5a3ae9","skill_id":"d87f030e-10df-4a12-ba7e-2f59ef7fea10","version":2,"content_hash":"706244f6d8cebf6adb778a85a0a3c8b3","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static command and URL findings are mostly Markdown documentation or expected MaxHub API usage, and MAXHUB_API_KEY access is declared as a required credential. However, the references repeatedly provide an encrypted WeChat video decryption workflow using decode_key values and external tooling, which creates a high policy and abuse risk that needs human marketplace review.","remediation":[],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":"_meta.json","line_end":6,"line_start":6},{"file":"_meta.json","line_end":7,"line_start":7},{"file":"README_CN.md","line_end":20,"line_start":20},{"file":"README_CN.md","line_end":34,"line_start":34},{"file":"README_CN.md","line_end":38,"line_start":38},{"file":"README.md","line_end":20,"line_start":20},{"file":"README.md","line_end":34,"line_start":34},{"file":"README.md","line_end":38,"line_start":38},{"file":"references/api-channels.md","line_end":3,"line_start":3},{"file":"references/api-channels.md","line_end":66,"line_start":66},{"file":"references/api-channels.md","line_end":76,"line_start":76},{"file":"references/api-channels.md","line_end":77,"line_start":77},{"file":"references/api-channels.md","line_end":113,"line_start":113},{"file":"references/api-channels.md","line_end":123,"line_start":123},{"file":"references/api-channels.md","line_end":124,"line_start":124},{"file":"references/api-channels.md","line_end":181,"line_start":181},{"file":"references/api-channels.md","line_end":190,"line_start":190},{"file":"references/api-channels.md","line_end":191,"line_start":191},{"file":"references/api-channels.md","line_end":203,"line_start":203},{"file":"references/api-channels.md","line_end":232,"line_start":232},{"file":"references/api-channels.md","line_end":263,"line_start":263},{"file":"references/api-channels.md","line_end":289,"line_start":289},{"file":"references/api-channels.md","line_end":401,"line_start":401},{"file":"references/api-channels.md","line_end":410,"line_start":410},{"file":"references/api-channels.md","line_end":411,"line_start":411},{"file":"references/api-channels.md","line_end":477,"line_start":477},{"file":"references/api-channels.md","line_end":486,"line_start":486},{"file":"references/api-channels.md","line_end":487,"line_start":487},{"file":"references/api-channels.md","line_end":555,"line_start":555},{"file":"references/api-channels.md","line_end":565,"line_start":565},{"file":"references/api-channels.md","line_end":605,"line_start":605},{"file":"references/api-channels.md","line_end":613,"line_start":613},{"file":"references/api-channels.md","line_end":614,"line_start":614},{"file":"references/api-mp.md","line_end":3,"line_start":3},{"file":"references/api-mp.md","line_end":17,"line_start":17},{"file":"references/api-mp.md","line_end":69,"line_start":69},{"file":"references/api-mp.md","line_end":146,"line_start":146},{"file":"references/param-mappings.md","line_end":3,"line_start":3},{"file":"references/param-mappings.md","line_end":13,"line_start":13},{"file":"references/param-mappings.md","line_end":17,"line_start":17},{"file":"references/param-mappings.md","line_end":30,"line_start":30},{"file":"references/param-mappings.md","line_end":34,"line_start":34},{"file":"references/param-mappings.md","line_end":43,"line_start":43},{"file":"references/param-mappings.md","line_end":56,"line_start":56},{"file":"references/param-mappings.md","line_end":96,"line_start":96},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":22,"line_start":22},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":32,"line_start":32},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":77,"line_start":77},{"file":"SKILL.md","line_end":88,"line_start":88}]},{"factor":"external_commands","evidence":[{"file":"README_CN.md","line_end":16,"line_start":14},{"file":"README_CN.md","line_end":21,"line_start":16},{"file":"README_CN.md","line_end":21,"line_start":21},{"file":"README.md","line_end":16,"line_start":14},{"file":"README.md","line_end":21,"line_start":16},{"file":"README.md","line_end":21,"line_start":21},{"file":"references/api-channels.md","line_end":3,"line_start":3},{"file":"references/api-channels.md","line_end":4,"line_start":4},{"file":"references/api-channels.md","line_end":9,"line_start":9},{"file":"references/api-channels.md","line_end":19,"line_start":19},{"file":"references/api-channels.md","line_end":35,"line_start":35},{"file":"references/api-channels.md","line_end":45,"line_start":45},{"file":"references/api-channels.md","line_end":55,"line_start":55},{"file":"references/api-channels.md","line_end":56,"line_start":56},{"file":"references/api-channels.md","line_end":60,"line_start":60},{"file":"references/api-channels.md","line_end":61,"line_start":61},{"file":"references/api-channels.md","line_end":61,"line_start":61},{"file":"references/api-channels.md","line_end":64,"line_start":64},{"file":"references/api-channels.md","line_end":65,"line_start":65},{"file":"references/api-channels.md","line_end":67,"line_start":67},{"file":"references/api-channels.md","line_end":68,"line_start":68},{"file":"references/api-channels.md","line_end":70,"line_start":70},{"file":"references/api-channels.md","line_end":70,"line_start":70},{"file":"references/api-channels.md","line_end":71,"line_start":71},{"file":"references/api-channels.md","line_end":72,"line_start":72},{"file":"references/api-channels.md","line_end":73,"line_start":73},{"file":"references/api-channels.md","line_end":74,"line_start":74},{"file":"references/api-channels.md","line_end":75,"line_start":75},{"file":"references/api-channels.md","line_end":81,"line_start":81},{"file":"references/api-channels.md","line_end":91,"line_start":91},{"file":"references/api-channels.md","line_end":102,"line_start":102},{"file":"references/api-channels.md","line_end":102,"line_start":102},{"file":"references/api-channels.md","line_end":103,"line_start":103},{"file":"references/api-channels.md","line_end":107,"line_start":107},{"file":"references/api-channels.md","line_end":108,"line_start":108},{"file":"references/api-channels.md","line_end":108,"line_start":108},{"file":"references/api-channels.md","line_end":111,"line_start":111},{"file":"references/api-channels.md","line_end":112,"line_start":112},{"file":"references/api-channels.md","line_end":114,"line_start":114},{"file":"references/api-channels.md","line_end":115,"line_start":115},{"file":"references/api-channels.md","line_end":117,"line_start":117},{"file":"references/api-channels.md","line_end":117,"line_start":117},{"file":"references/api-channels.md","line_end":118,"line_start":118},{"file":"references/api-channels.md","line_end":119,"line_start":119},{"file":"references/api-channels.md","line_end":120,"line_start":120},{"file":"references/api-channels.md","line_end":121,"line_start":121},{"file":"references/api-channels.md","line_end":122,"line_start":122},{"file":"references/api-channels.md","line_end":128,"line_start":128},{"file":"references/api-channels.md","line_end":138,"line_start":138},{"file":"references/api-channels.md","line_end":152,"line_start":152},{"file":"references/api-channels.md","line_end":164,"line_start":164},{"file":"references/api-channels.md","line_end":175,"line_start":175},{"file":"references/api-channels.md","line_end":176,"line_start":176},{"file":"references/api-channels.md","line_end":176,"line_start":176},{"file":"references/api-channels.md","line_end":179,"line_start":179},{"file":"references/api-channels.md","line_end":180,"line_start":180},{"file":"references/api-channels.md","line_end":182,"line_start":182},{"file":"references/api-channels.md","line_end":183,"line_start":183},{"file":"references/api-channels.md","line_end":185,"line_start":185},{"file":"references/api-channels.md","line_end":186,"line_start":186},{"file":"references/api-channels.md","line_end":187,"line_start":187},{"file":"references/api-channels.md","line_end":188,"line_start":188},{"file":"references/api-channels.md","line_end":189,"line_start":189},{"file":"references/api-channels.md","line_end":195,"line_start":195},{"file":"references/api-channels.md","line_end":209,"line_start":209},{"file":"references/api-channels.md","line_end":224,"line_start":224},{"file":"references/api-channels.md","line_end":239,"line_start":239},{"file":"references/api-channels.md","line_end":255,"line_start":255},{"file":"references/api-channels.md","line_end":267,"line_start":267},{"file":"references/api-channels.md","line_end":273,"line_start":273},{"file":"references/api-channels.md","line_end":281,"line_start":281},{"file":"references/api-channels.md","line_end":293,"line_start":293},{"file":"references/api-channels.md","line_end":307,"line_start":307},{"file":"references/api-channels.md","line_end":321,"line_start":321},{"file":"references/api-channels.md","line_end":330,"line_start":330},{"file":"references/api-channels.md","line_end":330,"line_start":330},{"file":"references/api-channels.md","line_end":330,"line_start":330},{"file":"references/api-channels.md","line_end":339,"line_start":339},{"file":"references/api-channels.md","line_end":353,"line_start":353},{"file":"references/api-channels.md","line_end":362,"line_start":362},{"file":"references/api-channels.md","line_end":362,"line_start":362},{"file":"references/api-channels.md","line_end":362,"line_start":362},{"file":"references/api-channels.md","line_end":371,"line_start":371},{"file":"references/api-channels.md","line_end":383,"line_start":383},{"file":"references/api-channels.md","line_end":395,"line_start":395},{"file":"references/api-channels.md","line_end":396,"line_start":396},{"file":"references/api-channels.md","line_end":396,"line_start":396},{"file":"references/api-channels.md","line_end":399,"line_start":399},{"file":"references/api-channels.md","line_end":400,"line_start":400},{"file":"references/api-channels.md","line_end":402,"line_start":402},{"file":"references/api-channels.md","line_end":403,"line_start":403},{"file":"references/api-channels.md","line_end":405,"line_start":405},{"file":"references/api-channels.md","line_end":406,"line_start":406},{"file":"references/api-channels.md","line_end":407,"line_start":407},{"file":"references/api-channels.md","line_end":408,"line_start":408},{"file":"references/api-channels.md","line_end":409,"line_start":409},{"file":"references/api-channels.md","line_end":415,"line_start":415},{"file":"references/api-channels.md","line_end":429,"line_start":429},{"file":"references/api-channels.md","line_end":438,"line_start":438},{"file":"references/api-channels.md","line_end":438,"line_start":438},{"file":"references/api-channels.md","line_end":438,"line_start":438},{"file":"references/api-channels.md","line_end":447,"line_start":447},{"file":"references/api-channels.md","line_end":459,"line_start":459},{"file":"references/api-channels.md","line_end":471,"line_start":471},{"file":"references/api-channels.md","line_end":472,"line_start":472},{"file":"references/api-channels.md","line_end":472,"line_start":472},{"file":"references/api-channels.md","line_end":475,"line_start":475},{"file":"references/api-channels.md","line_end":476,"line_start":476},{"file":"references/api-channels.md","line_end":478,"line_start":478},{"file":"references/api-channels.md","line_end":479,"line_start":479},{"file":"references/api-channels.md","line_end":481,"line_start":481},{"file":"references/api-channels.md","line_end":482,"line_start":482},{"file":"references/api-channels.md","line_end":483,"line_start":483},{"file":"references/api-channels.md","line_end":484,"line_start":484},{"file":"references/api-channels.md","line_end":485,"line_start":485},{"file":"references/api-channels.md","line_end":491,"line_start":491},{"file":"references/api-channels.md","line_end":504,"line_start":504},{"file":"references/api-channels.md","line_end":519,"line_start":519},{"file":"references/api-channels.md","line_end":532,"line_start":532},{"file":"references/api-channels.md","line_end":547,"line_start":547},{"file":"references/api-channels.md","line_end":559,"line_start":559},{"file":"references/api-channels.md","line_end":565,"line_start":565},{"file":"references/api-channels.md","line_end":573,"line_start":573},{"file":"references/api-channels.md","line_end":586,"line_start":586},{"file":"references/api-channels.md","line_end":599,"line_start":599},{"file":"references/api-channels.md","line_end":600,"line_start":600},{"file":"references/api-channels.md","line_end":600,"line_start":600},{"file":"references/api-channels.md","line_end":603,"line_start":603},{"file":"references/api-channels.md","line_end":604,"line_start":604},{"file":"references/api-channels.md","line_end":606,"line_start":606},{"file":"references/api-channels.md","line_end":607,"line_start":607},{"file":"references/api-channels.md","line_end":609,"line_start":609},{"file":"references/api-channels.md","line_end":610,"line_start":610},{"file":"references/api-channels.md","line_end":611,"line_start":611},{"file":"references/api-channels.md","line_end":612,"line_start":612},{"file":"references/api-mp.md","line_end":3,"line_start":3},{"file":"references/api-mp.md","line_end":4,"line_start":4},{"file":"references/api-mp.md","line_end":9,"line_start":9},{"file":"references/api-mp.md","line_end":21,"line_start":21},{"file":"references/api-mp.md","line_end":34,"line_start":34},{"file":"references/api-mp.md","line_end":47,"line_start":47},{"file":"references/api-mp.md","line_end":61,"line_start":61},{"file":"references/api-mp.md","line_end":74,"line_start":74},{"file":"references/api-mp.md","line_end":88,"line_start":88},{"file":"references/api-mp.md","line_end":100,"line_start":100},{"file":"references/api-mp.md","line_end":113,"line_start":113},{"file":"references/api-mp.md","line_end":125,"line_start":125},{"file":"references/api-mp.md","line_end":138,"line_start":138},{"file":"references/api-mp.md","line_end":150,"line_start":150},{"file":"references/param-mappings.md","line_end":3,"line_start":3},{"file":"references/param-mappings.md","line_end":3,"line_start":3},{"file":"references/param-mappings.md","line_end":9,"line_start":9},{"file":"references/param-mappings.md","line_end":9,"line_start":9},{"file":"references/param-mappings.md","line_end":13,"line_start":13},{"file":"references/param-mappings.md","line_end":13,"line_start":13},{"file":"references/param-mappings.md","line_end":17,"line_start":17},{"file":"references/param-mappings.md","line_end":17,"line_start":17},{"file":"references/param-mappings.md","line_end":18,"line_start":18},{"file":"references/param-mappings.md","line_end":19,"line_start":19},{"file":"references/param-mappings.md","line_end":23,"line_start":23},{"file":"references/param-mappings.md","line_end":24,"line_start":24},{"file":"references/param-mappings.md","line_end":24,"line_start":24},{"file":"references/param-mappings.md","line_end":25,"line_start":25},{"file":"references/param-mappings.md","line_end":25,"line_start":25},{"file":"references/param-mappings.md","line_end":26,"line_start":26},{"file":"references/param-mappings.md","line_end":30,"line_start":30},{"file":"references/param-mappings.md","line_end":30,"line_start":30},{"file":"references/param-mappings.md","line_end":34,"line_start":34},{"file":"references/param-mappings.md","line_end":34,"line_start":34},{"file":"references/param-mappings.md","line_end":38,"line_start":38},{"file":"references/param-mappings.md","line_end":38,"line_start":38},{"file":"references/param-mappings.md","line_end":39,"line_start":39},{"file":"references/param-mappings.md","line_end":43,"line_start":43},{"file":"references/param-mappings.md","line_end":43,"line_start":43},{"file":"references/param-mappings.md","line_end":44,"line_start":44},{"file":"references/param-mappings.md","line_end":48,"line_start":48},{"file":"references/param-mappings.md","line_end":48,"line_start":48},{"file":"references/param-mappings.md","line_end":52,"line_start":52},{"file":"references/param-mappings.md","line_end":52,"line_start":52},{"file":"references/param-mappings.md","line_end":56,"line_start":56},{"file":"references/param-mappings.md","line_end":56,"line_start":56},{"file":"references/param-mappings.md","line_end":60,"line_start":60},{"file":"references/param-mappings.md","line_end":60,"line_start":60},{"file":"references/param-mappings.md","line_end":61,"line_start":61},{"file":"references/param-mappings.md","line_end":62,"line_start":62},{"file":"references/param-mappings.md","line_end":66,"line_start":66},{"file":"references/param-mappings.md","line_end":66,"line_start":66},{"file":"references/param-mappings.md","line_end":67,"line_start":67},{"file":"references/param-mappings.md","line_end":68,"line_start":68},{"file":"references/param-mappings.md","line_end":72,"line_start":72},{"file":"references/param-mappings.md","line_end":72,"line_start":72},{"file":"references/param-mappings.md","line_end":76,"line_start":76},{"file":"references/param-mappings.md","line_end":76,"line_start":76},{"file":"references/param-mappings.md","line_end":77,"line_start":77},{"file":"references/param-mappings.md","line_end":78,"line_start":78},{"file":"references/param-mappings.md","line_end":82,"line_start":82},{"file":"references/param-mappings.md","line_end":82,"line_start":82},{"file":"references/param-mappings.md","line_end":86,"line_start":86},{"file":"references/param-mappings.md","line_end":86,"line_start":86},{"file":"references/param-mappings.md","line_end":87,"line_start":87},{"file":"references/param-mappings.md","line_end":91,"line_start":91},{"file":"references/param-mappings.md","line_end":91,"line_start":91},{"file":"references/param-mappings.md","line_end":92,"line_start":92},{"file":"references/param-mappings.md","line_end":96,"line_start":96},{"file":"references/param-mappings.md","line_end":96,"line_start":96},{"file":"references/param-mappings.md","line_end":100,"line_start":100},{"file":"references/param-mappings.md","line_end":100,"line_start":100},{"file":"references/param-mappings.md","line_end":101,"line_start":101},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":61,"line_start":49},{"file":"SKILL.md","line_end":67,"line_start":61},{"file":"SKILL.md","line_end":69,"line_start":67},{"file":"SKILL.md","line_end":80,"line_start":69},{"file":"SKILL.md","line_end":81,"line_start":80},{"file":"SKILL.md","line_end":91,"line_start":81},{"file":"SKILL.md","line_end":92,"line_start":91},{"file":"SKILL.md","line_end":106,"line_start":92},{"file":"SKILL.md","line_end":107,"line_start":106},{"file":"SKILL.md","line_end":165,"line_start":107}]},{"factor":"env_access","evidence":[{"file":"README_CN.md","line_end":21,"line_start":21},{"file":"README.md","line_end":21,"line_start":21},{"file":"references/api-channels.md","line_end":4,"line_start":4},{"file":"references/api-mp.md","line_end":4,"line_start":4},{"file":"SKILL.md","line_end":10,"line_start":10},{"file":"SKILL.md","line_end":13,"line_start":13},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":47,"line_start":47},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":68,"line_start":68},{"file":"SKILL.md","line_end":80,"line_start":80},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":91,"line_start":91},{"file":"SKILL.md","line_end":92,"line_start":92},{"file":"SKILL.md","line_end":92,"line_start":92}]}],"critical_findings":[],"high_findings":[{"title":"Encrypted WeChat Video Decryption Workflow","locations":[{"file":"references/api-channels.md","line_end":77,"line_start":60},{"file":"references/api-channels.md","line_end":124,"line_start":106},{"file":"references/api-channels.md","line_end":411,"line_start":394},{"file":"references/api-channels.md","line_end":614,"line_start":598}],"confidence":0.92,"description":"The API reference repeatedly instructs users to combine media CDN URLs with tokens, extract decode_key values, and use third-party or self-hosted tools to decrypt encrypted WeChat video files. This is not a weak algorithm false positive; it is a semantic risk because it can facilitate bypassing platform media protections.","confidence_reasoning":"The decryption instructions are explicit and repeated across multiple endpoint sections. They include decode_key extraction, CDN token concatenation, and links to decryption tools."}],"medium_findings":[{"title":"Credential-Bearing Network Requests to Third-Party API","locations":[{"file":"SKILL.md","line_end":18,"line_start":10},{"file":"SKILL.md","line_end":60,"line_start":45},{"file":"references/api-channels.md","line_end":4,"line_start":3},{"file":"references/api-mp.md","line_end":4,"line_start":3}],"confidence":0.81,"description":"The skill requires MAXHUB_API_KEY and sends it as an Authorization bearer token to https://www.aconfig.cn with curl examples. This is expected for the skill, but it creates secret-handling and third-party data exposure risk.","confidence_reasoning":"The file clearly declares MAXHUB_API_KEY as required and sensitive, and examples use it in Authorization headers. I found no evidence that the key is sent anywhere except the documented MaxHub API host."},{"title":"Autonomous External HTTP Execution Guidance","locations":[{"file":"SKILL.md","line_end":60,"line_start":49},{"file":"SKILL.md","line_end":140,"line_start":136}],"confidence":0.74,"description":"The instructions tell the assistant to execute planned queries autonomously and include curl examples for external API calls. This is legitimate for an API skill, but it should be constrained to documented MaxHub endpoints and user-approved data requests.","confidence_reasoning":"The curl commands and autonomous execution rules are present in the skill instructions. The risk is moderate because the destination is documented, not hidden or obfuscated."}],"low_findings":[{"title":"Markdown Backticks Flagged as Command Execution","locations":[{"file":"README.md","line_end":21,"line_start":14},{"file":"references/api-mp.md","line_end":21,"line_start":9},{"file":"references/param-mappings.md","line_end":13,"line_start":3}],"confidence":0.9,"description":"Most external command findings are Markdown code spans, fenced install examples, API paths, JSON paths, and parameter names. These are documentation artifacts rather than executable code in the skill package.","confidence_reasoning":"The cited examples are Markdown documentation and no script files exist in the scanned file list. The only executable pattern is the documented curl usage addressed separately."},{"title":"Hardcoded URLs Are Expected Service References","locations":[{"file":"_meta.json","line_end":7,"line_start":6},{"file":"README.md","line_end":38,"line_start":20},{"file":"SKILL.md","line_end":22,"line_start":21},{"file":"references/param-mappings.md","line_end":3,"line_start":3}],"confidence":0.88,"description":"The hardcoded URL findings point to the MaxHub homepage, repository metadata, WeChat example links, and documented API endpoints. These are expected for a networked API reference skill, although they confirm network dependency.","confidence_reasoning":"The URLs are visible documentation and metadata references, not concealed callback endpoints. They still support the network risk factor because the skill depends on an external API."},{"title":"Obfuscation Heuristic Not Confirmed","locations":[{"file":"references/api-channels.md","line_end":4,"line_start":1},{"file":"SKILL.md","line_end":60,"line_start":49}],"confidence":0.86,"description":"The high-entropy and dangerous-combination heuristic appears to be caused by long bilingual Markdown API references containing URLs, curl examples, JSON paths, and credential placeholders. I found no evidence of binary payloads, encrypted hidden content, prompt injection, or concealed scripts in the scanned files.","confidence_reasoning":"The scanned package contains Markdown and JSON metadata only, with no executable script files in the file list. The risky combination is still represented by documented network and credential usage, which is covered in medium findings."}],"dangerous_patterns":[{"title":"Encrypted WeChat Video Decryption Workflow","locations":[{"file":"references/api-channels.md","line_end":77,"line_start":60},{"file":"references/api-channels.md","line_end":124,"line_start":106},{"file":"references/api-channels.md","line_end":411,"line_start":394},{"file":"references/api-channels.md","line_end":614,"line_start":598}],"confidence":0.92,"description":"The API reference repeatedly instructs users to combine media CDN URLs with tokens, extract decode_key values, and use third-party or self-hosted tools to decrypt encrypted WeChat video files. This is not a weak algorithm false positive; it is a semantic risk because it can facilitate bypassing platform media protections.","confidence_reasoning":"The decryption instructions are explicit and repeated across multiple endpoint sections. They include decode_key extraction, CDN token concatenation, and links to decryption tools."},{"title":"Credential-Bearing Network Requests to Third-Party API","locations":[{"file":"SKILL.md","line_end":18,"line_start":10},{"file":"SKILL.md","line_end":60,"line_start":45},{"file":"references/api-channels.md","line_end":4,"line_start":3},{"file":"references/api-mp.md","line_end":4,"line_start":3}],"confidence":0.81,"description":"The skill requires MAXHUB_API_KEY and sends it as an Authorization bearer token to https://www.aconfig.cn with curl examples. This is expected for the skill, but it creates secret-handling and third-party data exposure risk.","confidence_reasoning":"The file clearly declares MAXHUB_API_KEY as required and sensitive, and examples use it in Authorization headers. I found no evidence that the key is sent anywhere except the documented MaxHub API host."},{"title":"Autonomous External HTTP Execution Guidance","locations":[{"file":"SKILL.md","line_end":60,"line_start":49},{"file":"SKILL.md","line_end":140,"line_start":136}],"confidence":0.74,"description":"The instructions tell the assistant to execute planned queries autonomously and include curl examples for external API calls. This is legitimate for an API skill, but it should be constrained to documented MaxHub endpoints and user-approved data requests.","confidence_reasoning":"The curl commands and autonomous execution rules are present in the skill instructions. The risk is moderate because the destination is documented, not hidden or obfuscated."}],"files_scanned":7,"total_lines":1171,"audit_model":"codex","audited_at":"2026-07-01T00:26:25.214+00:00","created_at":"2026-07-01T02:22:16.732239+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":3,"capabilityReviewCount":3,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}